In the context of maintaining covert access, how can steganography be used?

By hiding malicious code or data inside innocent-looking files such as images or audio

By encrypting the entire hard drive with a strong algorithm

By deleting all system logs to cover tracks

By creating a new user account with administrative privileges

A penetration tester has gained local administrator access on a Windows server that is protected by an EDR solution. The tester wants to install a rootkit to hide malicious activity, but the EDR is known to detect unsigned kernel drivers. Which approach is most likely to succeed?

Use a signed, legitimate kernel driver that has a known vulnerability to gain kernel-level code execution

Load the rootkit as a user-mode process that hooks user APIs

Disable the EDR service before loading the rootkit

Use a kernel debugger to patch the EDR's driver

An attacker has compromised a web server and wants to hide a backdoor payload from file-based malware scanners. The attacker has write access to the web root. Which technique is most effective?

Embed the payload in the EXIF metadata of a legitimate JPEG image

Compress the payload with ZIP and change the extension to .png

Base64-encode the payload and store it in a text file

Rename the payload file to a .jpg extension

What is the primary role of a rootkit in maintaining privileged access?

To hide malicious activities and files from the operating system and security tools

To encrypt network traffic to avoid detection

To crack passwords of user accounts

To scan for open ports on the network

An attacker wants to maintain access to a user's workstation by disguising a remote access tool as a legitimate utility. The user frequently downloads free PDF converters. Which technique is most aligned with this goal?

Place a backdoor in the Windows Registry Run key

Create a scheduled task that runs the remote access tool at logon

Use steganography to hide the remote access tool inside a JPEG image

Bind the remote access tool to a legitimate PDF converter installer using a wrapper

EC-CouncilCertified Ethical Hacker

Domain 3Objective 5

Maintaining Access and Persistence CEH Practice Questions (Page 4)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 16–20

16foundation · easy
In the context of maintaining covert access, how can steganography be used?
Select an answer first
17expert · hard
A penetration tester has gained local administrator access on a Windows server that is protected by an EDR solution. The tester wants to install a rootkit to hide malicious activity, but the EDR is known to detect unsigned kernel drivers. Which approach is most likely to succeed?
Select an answer first
18application · medium
An attacker has compromised a web server and wants to hide a backdoor payload from file-based malware scanners. The attacker has write access to the web root. Which technique is most effective?
Select an answer first
19foundation · easy
What is the primary role of a rootkit in maintaining privileged access?
Select an answer first
20application · medium
An attacker wants to maintain access to a user's workstation by disguising a remote access tool as a legitimate utility. The user frequently downloads free PDF converters. Which technique is most aligned with this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.